xref: /openbmc/qemu/hw/m68k/next-cube.c (revision 9c2ff9cdc9b33472333e9431cbf4417f5f228883)
1 /*
2  * NeXT Cube System Driver
3  *
4  * Copyright (c) 2011 Bryce Lanham
5  * Copyright (c) 2024 Mark Cave-Ayland
6  *
7  * This code is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License as published
9  * by the Free Software Foundation; either version 2 of the License,
10  * or (at your option) any later version.
11  */
12 
13 #include "qemu/osdep.h"
14 #include "exec/hwaddr.h"
15 #include "exec/cpu-interrupt.h"
16 #include "system/system.h"
17 #include "system/qtest.h"
18 #include "hw/irq.h"
19 #include "hw/m68k/next-cube.h"
20 #include "hw/boards.h"
21 #include "hw/loader.h"
22 #include "hw/scsi/esp.h"
23 #include "hw/sysbus.h"
24 #include "qom/object.h"
25 #include "hw/char/escc.h" /* ZILOG 8530 Serial Emulation */
26 #include "hw/block/fdc.h"
27 #include "hw/misc/empty_slot.h"
28 #include "hw/qdev-properties.h"
29 #include "qapi/error.h"
30 #include "qemu/error-report.h"
31 #include "ui/console.h"
32 #include "target/m68k/cpu.h"
33 #include "migration/vmstate.h"
34 
35 /* #define DEBUG_NEXT */
36 #ifdef DEBUG_NEXT
37 #define DPRINTF(fmt, ...) \
38     do { printf("NeXT: " fmt , ## __VA_ARGS__); } while (0)
39 #else
40 #define DPRINTF(fmt, ...) do { } while (0)
41 #endif
42 
43 #define ENTRY       0x0100001e
44 #define RAM_SIZE    0x4000000
45 #define ROM_FILE    "Rev_2.5_v66.bin"
46 
47 
48 #define TYPE_NEXT_RTC "next-rtc"
49 OBJECT_DECLARE_SIMPLE_TYPE(NeXTRTC, NEXT_RTC)
50 
51 struct NeXTRTC {
52     SysBusDevice parent_obj;
53 
54     int8_t phase;
55     uint8_t ram[32];
56     uint8_t command;
57     uint8_t value;
58     uint8_t status;
59     uint8_t control;
60     uint8_t retval;
61 
62     qemu_irq data_out_irq;
63     qemu_irq power_irq;
64 };
65 
66 #define TYPE_NEXT_SCSI "next-scsi"
67 OBJECT_DECLARE_SIMPLE_TYPE(NeXTSCSI, NEXT_SCSI)
68 
69 /* NeXT SCSI Controller */
70 struct NeXTSCSI {
71     SysBusDevice parent_obj;
72 
73     MemoryRegion scsi_mem;
74 
75     SysBusESPState sysbus_esp;
76 
77     MemoryRegion scsi_csr_mem;
78     uint8_t scsi_csr_1;
79     uint8_t scsi_csr_2;
80 };
81 
82 #define TYPE_NEXT_PC "next-pc"
83 OBJECT_DECLARE_SIMPLE_TYPE(NeXTPC, NEXT_PC)
84 
85 /* NeXT Peripheral Controller */
86 struct NeXTPC {
87     SysBusDevice parent_obj;
88 
89     M68kCPU *cpu;
90 
91     MemoryRegion floppy_mem;
92     MemoryRegion timer_mem;
93     MemoryRegion dummyen_mem;
94     MemoryRegion mmiomem;
95     MemoryRegion scrmem;
96 
97     uint32_t scr1;
98     uint32_t scr2;
99     uint32_t old_scr2;
100     uint32_t int_mask;
101     uint32_t int_status;
102     uint32_t led;
103 
104     NeXTSCSI next_scsi;
105 
106     qemu_irq scsi_reset;
107     qemu_irq scsi_dma;
108 
109     ESCCState escc;
110 
111     NeXTRTC rtc;
112     qemu_irq rtc_data_irq;
113     qemu_irq rtc_cmd_reset_irq;
114 };
115 
116 typedef struct next_dma {
117     uint32_t csr;
118 
119     uint32_t saved_next;
120     uint32_t saved_limit;
121     uint32_t saved_start;
122     uint32_t saved_stop;
123 
124     uint32_t next;
125     uint32_t limit;
126     uint32_t start;
127     uint32_t stop;
128 
129     uint32_t next_initbuf;
130     uint32_t size;
131 } next_dma;
132 
133 #define TYPE_NEXT_MACHINE MACHINE_TYPE_NAME("next-cube")
134 OBJECT_DECLARE_SIMPLE_TYPE(NeXTState, NEXT_MACHINE)
135 
136 struct NeXTState {
137     MachineState parent;
138 
139     MemoryRegion rom;
140     MemoryRegion rom2;
141     MemoryRegion dmamem;
142     MemoryRegion bmapm1;
143     MemoryRegion bmapm2;
144 
145     next_dma dma[10];
146 };
147 
148 /* Thanks to NeXT forums for this */
149 /*
150 static const uint8_t rtc_ram3[32] = {
151     0x94, 0x0f, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00,
152     0x00, 0x00, 0xfb, 0x6d, 0x00, 0x00, 0x7B, 0x00,
153     0x00, 0x00, 0x65, 0x6e, 0x00, 0x00, 0x00, 0x00,
154     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x13
155 };
156 */
157 static const uint8_t rtc_ram2[32] = {
158     0x94, 0x0f, 0x40, 0x03, 0x00, 0x00, 0x00, 0x00,
159     0x00, 0x00, 0xfb, 0x6d, 0x00, 0x00, 0x4b, 0x00,
160     0x41, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00,
161     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x84, 0x7e,
162 };
163 
164 #define SCR2_RTCLK 0x2
165 #define SCR2_RTDATA 0x4
166 #define SCR2_TOBCD(x) (((x / 10) << 4) + (x % 10))
167 
168 static void next_scr2_led_update(NeXTPC *s)
169 {
170     if (s->scr2 & 0x1) {
171         DPRINTF("fault!\n");
172         s->led++;
173         if (s->led == 10) {
174             DPRINTF("LED flashing, possible fault!\n");
175             s->led = 0;
176         }
177     }
178 }
179 
180 static void next_scr2_rtc_update(NeXTPC *s)
181 {
182     uint8_t old_scr2_rtc, scr2_rtc;
183 
184     old_scr2_rtc = extract32(s->old_scr2, 8, 8);
185     scr2_rtc = extract32(s->scr2, 8, 8);
186 
187     if (scr2_rtc & 0x1) {
188         /* DPRINTF("RTC %x phase %i\n", scr2_2, rtc->phase); */
189         /* If we are in going down clock... do something */
190         if (((old_scr2_rtc & SCR2_RTCLK) != (scr2_rtc & SCR2_RTCLK)) &&
191                 ((scr2_rtc & SCR2_RTCLK) == 0)) {
192             if (scr2_rtc & SCR2_RTDATA) {
193                 qemu_irq_raise(s->rtc_data_irq);
194             } else {
195                 qemu_irq_lower(s->rtc_data_irq);
196             }
197         }
198     } else {
199         /* else end or abort */
200         qemu_irq_raise(s->rtc_cmd_reset_irq);
201     }
202 }
203 
204 static uint64_t next_mmio_read(void *opaque, hwaddr addr, unsigned size)
205 {
206     NeXTPC *s = NEXT_PC(opaque);
207     uint64_t val;
208 
209     switch (addr) {
210     case 0x2000:    /* 0x2007000 */
211         /* DPRINTF("Read INT status: %x\n", s->int_status); */
212         val = s->int_status;
213         break;
214 
215     case 0x2800:    /* 0x2007800 */
216         DPRINTF("MMIO Read INT mask: %x\n", s->int_mask);
217         val = s->int_mask;
218         break;
219 
220     case 0x7000 ... 0x7003:    /* 0x200c000 */
221         val = extract32(s->scr1, (4 - (addr - 0x7000) - size) << 3,
222                         size << 3);
223         break;
224 
225     case 0x8000 ... 0x8003:    /* 0x200d000 */
226         val = extract32(s->scr2, (4 - (addr - 0x8000) - size) << 3,
227                         size << 3);
228         break;
229 
230     default:
231         val = 0;
232         DPRINTF("MMIO Read @ 0x%"HWADDR_PRIx" size %d\n", addr, size);
233         break;
234     }
235 
236     return val;
237 }
238 
239 static void next_mmio_write(void *opaque, hwaddr addr, uint64_t val,
240                             unsigned size)
241 {
242     NeXTPC *s = NEXT_PC(opaque);
243 
244     switch (addr) {
245     case 0x2000:    /* 0x2007000 */
246         DPRINTF("INT Status old: %x new: %x\n", s->int_status,
247                 (unsigned int)val);
248         s->int_status = val;
249         break;
250 
251     case 0x2800:    /* 0x2007800 */
252         DPRINTF("INT Mask old: %x new: %x\n", s->int_mask, (unsigned int)val);
253         s->int_mask  = val;
254         break;
255 
256     case 0x7000 ... 0x7003:    /* 0x200c000 */
257         DPRINTF("SCR1 Write: %x\n", (unsigned int)val);
258         s->scr1 = deposit32(s->scr1, (4 - (addr - 0x7000) - size) << 3,
259                             size << 3, val);
260         break;
261 
262     case 0x8000 ... 0x8003:    /* 0x200d000 */
263         s->scr2 = deposit32(s->scr2, (4 - (addr - 0x8000) - size) << 3,
264                             size << 3, val);
265         next_scr2_led_update(s);
266         next_scr2_rtc_update(s);
267         s->old_scr2 = s->scr2;
268         break;
269 
270     default:
271         DPRINTF("MMIO Write @ 0x%"HWADDR_PRIx " with 0x%x size %u\n", addr,
272                 (unsigned int)val, size);
273     }
274 }
275 
276 static const MemoryRegionOps next_mmio_ops = {
277     .read = next_mmio_read,
278     .write = next_mmio_write,
279     .valid.min_access_size = 1,
280     .valid.max_access_size = 4,
281     .endianness = DEVICE_BIG_ENDIAN,
282 };
283 
284 #define SCSICSR_ENABLE  0x01
285 #define SCSICSR_RESET   0x02  /* reset scsi dma */
286 #define SCSICSR_FIFOFL  0x04
287 #define SCSICSR_DMADIR  0x08  /* if set, scsi to mem */
288 #define SCSICSR_CPUDMA  0x10  /* if set, dma enabled */
289 #define SCSICSR_INTMASK 0x20  /* if set, interrupt enabled */
290 
291 #define NEXTDMA_SCSI(x)      (0x10 + x)
292 #define NEXTDMA_FD(x)        (0x10 + x)
293 #define NEXTDMA_ENTX(x)      (0x110 + x)
294 #define NEXTDMA_ENRX(x)      (0x150 + x)
295 #define NEXTDMA_CSR          0x0
296 #define NEXTDMA_NEXT         0x4000
297 #define NEXTDMA_LIMIT        0x4004
298 #define NEXTDMA_START        0x4008
299 #define NEXTDMA_STOP         0x400c
300 #define NEXTDMA_NEXT_INIT    0x4200
301 #define NEXTDMA_SIZE         0x4204
302 
303 static void next_dma_write(void *opaque, hwaddr addr, uint64_t val,
304                            unsigned int size)
305 {
306     NeXTState *next_state = NEXT_MACHINE(opaque);
307 
308     switch (addr) {
309     case NEXTDMA_ENRX(NEXTDMA_CSR):
310         if (val & DMA_DEV2M) {
311             next_state->dma[NEXTDMA_ENRX].csr |= DMA_DEV2M;
312         }
313 
314         if (val & DMA_SETENABLE) {
315             /* DPRINTF("SCSI DMA ENABLE\n"); */
316             next_state->dma[NEXTDMA_ENRX].csr |= DMA_ENABLE;
317         }
318         if (val & DMA_SETSUPDATE) {
319             next_state->dma[NEXTDMA_ENRX].csr |= DMA_SUPDATE;
320         }
321         if (val & DMA_CLRCOMPLETE) {
322             next_state->dma[NEXTDMA_ENRX].csr &= ~DMA_COMPLETE;
323         }
324 
325         if (val & DMA_RESET) {
326             next_state->dma[NEXTDMA_ENRX].csr &= ~(DMA_COMPLETE | DMA_SUPDATE |
327                                                   DMA_ENABLE | DMA_DEV2M);
328         }
329         /* DPRINTF("RXCSR \tWrite: %x\n",value); */
330         break;
331 
332     case NEXTDMA_ENRX(NEXTDMA_NEXT_INIT):
333         next_state->dma[NEXTDMA_ENRX].next_initbuf = val;
334         break;
335 
336     case NEXTDMA_ENRX(NEXTDMA_NEXT):
337         next_state->dma[NEXTDMA_ENRX].next = val;
338         break;
339 
340     case NEXTDMA_ENRX(NEXTDMA_LIMIT):
341         next_state->dma[NEXTDMA_ENRX].limit = val;
342         break;
343 
344     case NEXTDMA_SCSI(NEXTDMA_CSR):
345         if (val & DMA_DEV2M) {
346             next_state->dma[NEXTDMA_SCSI].csr |= DMA_DEV2M;
347         }
348         if (val & DMA_SETENABLE) {
349             /* DPRINTF("SCSI DMA ENABLE\n"); */
350             next_state->dma[NEXTDMA_SCSI].csr |= DMA_ENABLE;
351         }
352         if (val & DMA_SETSUPDATE) {
353             next_state->dma[NEXTDMA_SCSI].csr |= DMA_SUPDATE;
354         }
355         if (val & DMA_CLRCOMPLETE) {
356             next_state->dma[NEXTDMA_SCSI].csr &= ~DMA_COMPLETE;
357         }
358 
359         if (val & DMA_RESET) {
360             next_state->dma[NEXTDMA_SCSI].csr &= ~(DMA_COMPLETE | DMA_SUPDATE |
361                                                   DMA_ENABLE | DMA_DEV2M);
362             /* DPRINTF("SCSI DMA RESET\n"); */
363         }
364         /* DPRINTF("RXCSR \tWrite: %x\n",value); */
365         break;
366 
367     case NEXTDMA_SCSI(NEXTDMA_NEXT):
368         next_state->dma[NEXTDMA_SCSI].next = val;
369         break;
370 
371     case NEXTDMA_SCSI(NEXTDMA_LIMIT):
372         next_state->dma[NEXTDMA_SCSI].limit = val;
373         break;
374 
375     case NEXTDMA_SCSI(NEXTDMA_START):
376         next_state->dma[NEXTDMA_SCSI].start = val;
377         break;
378 
379     case NEXTDMA_SCSI(NEXTDMA_STOP):
380         next_state->dma[NEXTDMA_SCSI].stop = val;
381         break;
382 
383     case NEXTDMA_SCSI(NEXTDMA_NEXT_INIT):
384         next_state->dma[NEXTDMA_SCSI].next_initbuf = val;
385         break;
386 
387     default:
388         DPRINTF("DMA write @ %x w/ %x\n", (unsigned)addr, (unsigned)val);
389     }
390 }
391 
392 static uint64_t next_dma_read(void *opaque, hwaddr addr, unsigned int size)
393 {
394     NeXTState *next_state = NEXT_MACHINE(opaque);
395     uint64_t val;
396 
397     switch (addr) {
398     case NEXTDMA_SCSI(NEXTDMA_CSR):
399         DPRINTF("SCSI DMA CSR READ\n");
400         val = next_state->dma[NEXTDMA_SCSI].csr;
401         break;
402 
403     case NEXTDMA_ENRX(NEXTDMA_CSR):
404         val = next_state->dma[NEXTDMA_ENRX].csr;
405         break;
406 
407     case NEXTDMA_ENRX(NEXTDMA_NEXT_INIT):
408         val = next_state->dma[NEXTDMA_ENRX].next_initbuf;
409         break;
410 
411     case NEXTDMA_ENRX(NEXTDMA_NEXT):
412         val = next_state->dma[NEXTDMA_ENRX].next;
413         break;
414 
415     case NEXTDMA_ENRX(NEXTDMA_LIMIT):
416         val = next_state->dma[NEXTDMA_ENRX].limit;
417         break;
418 
419     case NEXTDMA_SCSI(NEXTDMA_NEXT):
420         val = next_state->dma[NEXTDMA_SCSI].next;
421         break;
422 
423     case NEXTDMA_SCSI(NEXTDMA_NEXT_INIT):
424         val = next_state->dma[NEXTDMA_SCSI].next_initbuf;
425         break;
426 
427     case NEXTDMA_SCSI(NEXTDMA_LIMIT):
428         val = next_state->dma[NEXTDMA_SCSI].limit;
429         break;
430 
431     case NEXTDMA_SCSI(NEXTDMA_START):
432         val = next_state->dma[NEXTDMA_SCSI].start;
433         break;
434 
435     case NEXTDMA_SCSI(NEXTDMA_STOP):
436         val = next_state->dma[NEXTDMA_SCSI].stop;
437         break;
438 
439     default:
440         DPRINTF("DMA read @ %x\n", (unsigned int)addr);
441         val = 0;
442     }
443 
444     /*
445      * once the csr's are done, subtract 0x3FEC from the addr, and that will
446      * normalize the upper registers
447      */
448 
449     return val;
450 }
451 
452 static const MemoryRegionOps next_dma_ops = {
453     .read = next_dma_read,
454     .write = next_dma_write,
455     .impl.min_access_size = 4,
456     .valid.min_access_size = 4,
457     .valid.max_access_size = 4,
458     .endianness = DEVICE_BIG_ENDIAN,
459 };
460 
461 static void next_irq(void *opaque, int number, int level)
462 {
463     NeXTPC *s = NEXT_PC(opaque);
464     M68kCPU *cpu = s->cpu;
465     int shift = 0;
466 
467     /* first switch sets interrupt status */
468     /* DPRINTF("IRQ %i\n",number); */
469     switch (number) {
470     /* level 3 - floppy, kbd/mouse, power, ether rx/tx, scsi, clock */
471     case NEXT_FD_I:
472         shift = 7;
473         break;
474     case NEXT_KBD_I:
475         shift = 3;
476         break;
477     case NEXT_PWR_I:
478         shift = 2;
479         break;
480     case NEXT_ENRX_I:
481         shift = 9;
482         break;
483     case NEXT_ENTX_I:
484         shift = 10;
485         break;
486     case NEXT_SCSI_I:
487         shift = 12;
488         break;
489     case NEXT_CLK_I:
490         shift = 5;
491         break;
492 
493     /* level 5 - scc (serial) */
494     case NEXT_SCC_I:
495         shift = 17;
496         break;
497 
498     /* level 6 - audio etherrx/tx dma */
499     case NEXT_ENTX_DMA_I:
500         shift = 28;
501         break;
502     case NEXT_ENRX_DMA_I:
503         shift = 27;
504         break;
505     case NEXT_SCSI_DMA_I:
506         shift = 26;
507         break;
508     case NEXT_SND_I:
509         shift = 23;
510         break;
511     case NEXT_SCC_DMA_I:
512         shift = 21;
513         break;
514 
515     }
516     /*
517      * this HAS to be wrong, the interrupt handlers in mach and together
518      * int_status and int_mask and return if there is a hit
519      */
520     if (s->int_mask & (1 << shift)) {
521         DPRINTF("%x interrupt masked @ %x\n", 1 << shift, cpu->env.pc);
522         /* return; */
523     }
524 
525     /* second switch triggers the correct interrupt */
526     if (level) {
527         s->int_status |= 1 << shift;
528 
529         switch (number) {
530         /* level 3 - floppy, kbd/mouse, power, ether rx/tx, scsi, clock */
531         case NEXT_FD_I:
532         case NEXT_KBD_I:
533         case NEXT_PWR_I:
534         case NEXT_ENRX_I:
535         case NEXT_ENTX_I:
536         case NEXT_SCSI_I:
537         case NEXT_CLK_I:
538             m68k_set_irq_level(cpu, 3, 27);
539             break;
540 
541         /* level 5 - scc (serial) */
542         case NEXT_SCC_I:
543             m68k_set_irq_level(cpu, 5, 29);
544             break;
545 
546         /* level 6 - audio etherrx/tx dma */
547         case NEXT_ENTX_DMA_I:
548         case NEXT_ENRX_DMA_I:
549         case NEXT_SCSI_DMA_I:
550         case NEXT_SND_I:
551         case NEXT_SCC_DMA_I:
552             m68k_set_irq_level(cpu, 6, 30);
553             break;
554         }
555     } else {
556         s->int_status &= ~(1 << shift);
557         cpu_reset_interrupt(CPU(cpu), CPU_INTERRUPT_HARD);
558     }
559 }
560 
561 static void nextdma_write(void *opaque, uint8_t *buf, int size, int type)
562 {
563     uint32_t base_addr;
564     int irq = 0;
565     uint8_t align = 16;
566     NeXTState *next_state = NEXT_MACHINE(qdev_get_machine());
567 
568     if (type == NEXTDMA_ENRX || type == NEXTDMA_ENTX) {
569         align = 32;
570     }
571     /* Most DMA is supposedly 16 byte aligned */
572     if ((size % align) != 0) {
573         size -= size % align;
574         size += align;
575     }
576 
577     /*
578      * prom sets the dma start using initbuf while the bootloader uses next
579      * so we check to see if initbuf is 0
580      */
581     if (next_state->dma[type].next_initbuf == 0) {
582         base_addr = next_state->dma[type].next;
583     } else {
584         base_addr = next_state->dma[type].next_initbuf;
585     }
586 
587     cpu_physical_memory_write(base_addr, buf, size);
588 
589     next_state->dma[type].next_initbuf = 0;
590 
591     /* saved limit is checked to calculate packet size by both, rom and netbsd */
592     next_state->dma[type].saved_limit = (next_state->dma[type].next + size);
593     next_state->dma[type].saved_next  = (next_state->dma[type].next);
594 
595     /*
596      * 32 bytes under savedbase seems to be some kind of register
597      * of which the purpose is unknown as of yet
598      */
599     /* stl_phys(s->rx_dma.base-32,0xFFFFFFFF); */
600 
601     if (!(next_state->dma[type].csr & DMA_SUPDATE)) {
602         next_state->dma[type].next  = next_state->dma[type].start;
603         next_state->dma[type].limit = next_state->dma[type].stop;
604     }
605 
606     /* Set dma registers and raise an irq */
607     next_state->dma[type].csr |= DMA_COMPLETE; /* DON'T CHANGE THIS! */
608 
609     switch (type) {
610     case NEXTDMA_SCSI:
611         irq = NEXT_SCSI_DMA_I;
612         break;
613     }
614 
615     next_irq(opaque, irq, 1);
616     next_irq(opaque, irq, 0);
617 }
618 
619 static void nextscsi_read(void *opaque, uint8_t *buf, int len)
620 {
621     DPRINTF("SCSI READ: %x\n", len);
622     abort();
623 }
624 
625 static void nextscsi_write(void *opaque, uint8_t *buf, int size)
626 {
627     DPRINTF("SCSI WRITE: %i\n", size);
628     nextdma_write(opaque, buf, size, NEXTDMA_SCSI);
629 }
630 
631 static void next_scsi_csr_write(void *opaque, hwaddr addr, uint64_t val,
632                                 unsigned size)
633 {
634     NeXTSCSI *s = NEXT_SCSI(opaque);
635     NeXTPC *pc = NEXT_PC(container_of(s, NeXTPC, next_scsi));
636 
637     switch (addr) {
638     case 0:
639         if (val & SCSICSR_FIFOFL) {
640             DPRINTF("SCSICSR FIFO Flush\n");
641             /* will have to add another irq to the esp if this is needed */
642             /* esp_puflush_fifo(esp_g); */
643         }
644 
645         if (val & SCSICSR_ENABLE) {
646             DPRINTF("SCSICSR Enable\n");
647             /*
648              * qemu_irq_raise(s->scsi_dma);
649              * s->scsi_csr_1 = 0xc0;
650              * s->scsi_csr_1 |= 0x1;
651              * qemu_irq_pulse(s->scsi_dma);
652              */
653         }
654         /*
655          * else
656          *     s->scsi_csr_1 &= ~SCSICSR_ENABLE;
657          */
658 
659         if (val & SCSICSR_RESET) {
660             DPRINTF("SCSICSR Reset\n");
661             /* I think this should set DMADIR. CPUDMA and INTMASK to 0 */
662             qemu_irq_raise(pc->scsi_reset);
663             s->scsi_csr_1 &= ~(SCSICSR_INTMASK | 0x80 | 0x1);
664             qemu_irq_lower(pc->scsi_reset);
665         }
666         if (val & SCSICSR_DMADIR) {
667             DPRINTF("SCSICSR DMAdir\n");
668         }
669         if (val & SCSICSR_CPUDMA) {
670             DPRINTF("SCSICSR CPUDMA\n");
671             /* qemu_irq_raise(s->scsi_dma); */
672             pc->int_status |= 0x4000000;
673         } else {
674             /* fprintf(stderr,"SCSICSR CPUDMA disabled\n"); */
675             pc->int_status &= ~(0x4000000);
676             /* qemu_irq_lower(s->scsi_dma); */
677         }
678         if (val & SCSICSR_INTMASK) {
679             DPRINTF("SCSICSR INTMASK\n");
680             /*
681              * int_mask &= ~0x1000;
682              * s->scsi_csr_1 |= val;
683              * s->scsi_csr_1 &= ~SCSICSR_INTMASK;
684              * if (s->scsi_queued) {
685              *     s->scsi_queued = 0;
686              *     next_irq(s, NEXT_SCSI_I, level);
687              * }
688              */
689         } else {
690             /* int_mask |= 0x1000; */
691         }
692         if (val & 0x80) {
693             /* int_mask |= 0x1000; */
694             /* s->scsi_csr_1 |= 0x80; */
695         }
696         DPRINTF("SCSICSR1 Write: %"PRIx64 "\n", val);
697         s->scsi_csr_1 = val;
698         break;
699 
700     case 1:
701         DPRINTF("SCSICSR2 Write: %"PRIx64 "\n", val);
702         s->scsi_csr_2 = val;
703         break;
704 
705     default:
706         g_assert_not_reached();
707     }
708 }
709 
710 static uint64_t next_scsi_csr_read(void *opaque, hwaddr addr, unsigned size)
711 {
712     NeXTSCSI *s = NEXT_SCSI(opaque);
713     uint64_t val;
714 
715     switch (addr) {
716     case 0:
717         DPRINTF("SCSI 4020  STATUS READ %X\n", s->scsi_csr_1);
718         val = s->scsi_csr_1;
719         break;
720 
721     case 1:
722         DPRINTF("SCSI 4021 STATUS READ %X\n", s->scsi_csr_2);
723         val = s->scsi_csr_2;
724         break;
725 
726     default:
727         g_assert_not_reached();
728     }
729 
730     return val;
731 }
732 
733 static const MemoryRegionOps next_scsi_csr_ops = {
734     .read = next_scsi_csr_read,
735     .write = next_scsi_csr_write,
736     .valid.min_access_size = 1,
737     .valid.max_access_size = 1,
738     .endianness = DEVICE_BIG_ENDIAN,
739 };
740 
741 static void next_scsi_init(Object *obj)
742 {
743     NeXTSCSI *s = NEXT_SCSI(obj);
744     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
745 
746     object_initialize_child(obj, "esp", &s->sysbus_esp, TYPE_SYSBUS_ESP);
747 
748     memory_region_init_io(&s->scsi_csr_mem, obj, &next_scsi_csr_ops,
749                           s, "csrs", 2);
750 
751     memory_region_init(&s->scsi_mem, obj, "next.scsi", 0x40);
752     sysbus_init_mmio(sbd, &s->scsi_mem);
753 }
754 
755 static void next_scsi_realize(DeviceState *dev, Error **errp)
756 {
757     NeXTSCSI *s = NEXT_SCSI(dev);
758     SysBusESPState *sysbus_esp;
759     SysBusDevice *sbd;
760     ESPState *esp;
761     NeXTPC *pcdev;
762 
763     pcdev = NEXT_PC(container_of(s, NeXTPC, next_scsi));
764 
765     /* ESP */
766     sysbus_esp = SYSBUS_ESP(&s->sysbus_esp);
767     esp = &sysbus_esp->esp;
768     esp->dma_memory_read = nextscsi_read;
769     esp->dma_memory_write = nextscsi_write;
770     esp->dma_opaque = pcdev;
771     sysbus_esp->it_shift = 0;
772     esp->dma_enabled = 1;
773     sbd = SYS_BUS_DEVICE(sysbus_esp);
774     if (!sysbus_realize(sbd, errp)) {
775         return;
776     }
777     memory_region_add_subregion(&s->scsi_mem, 0x0,
778                                 sysbus_mmio_get_region(sbd, 0));
779 
780     /* SCSI CSRs */
781     memory_region_add_subregion(&s->scsi_mem, 0x20, &s->scsi_csr_mem);
782 
783     scsi_bus_legacy_handle_cmdline(&s->sysbus_esp.esp.bus);
784 }
785 
786 static const VMStateDescription next_scsi_vmstate = {
787     .name = "next-scsi",
788     .version_id = 0,
789     .minimum_version_id = 0,
790     .fields = (const VMStateField[]) {
791         VMSTATE_UINT8(scsi_csr_1, NeXTSCSI),
792         VMSTATE_UINT8(scsi_csr_2, NeXTSCSI),
793         VMSTATE_END_OF_LIST()
794     },
795 };
796 
797 static void next_scsi_class_init(ObjectClass *klass, void *data)
798 {
799     DeviceClass *dc = DEVICE_CLASS(klass);
800 
801     dc->desc = "NeXT SCSI Controller";
802     dc->realize = next_scsi_realize;
803     dc->vmsd = &next_scsi_vmstate;
804 }
805 
806 static const TypeInfo next_scsi_info = {
807     .name = TYPE_NEXT_SCSI,
808     .parent = TYPE_SYS_BUS_DEVICE,
809     .instance_init = next_scsi_init,
810     .instance_size = sizeof(NeXTSCSI),
811     .class_init = next_scsi_class_init,
812 };
813 
814 static void next_floppy_write(void *opaque, hwaddr addr, uint64_t val,
815                               unsigned size)
816 {
817     switch (addr) {
818     case 0:
819         DPRINTF("FDCSR Write: %"PRIx64 "\n", val);
820         if (val == 0x0) {
821             /* qemu_irq_raise(s->fd_irq[0]); */
822         }
823         break;
824 
825     default:
826         g_assert_not_reached();
827     }
828 }
829 
830 static uint64_t next_floppy_read(void *opaque, hwaddr addr, unsigned size)
831 {
832     uint64_t val;
833 
834     switch (addr) {
835     case 0:
836         DPRINTF("FD read @ %x\n", (unsigned int)addr);
837         val = 0x40 | 0x04 | 0x2 | 0x1;
838         break;
839 
840     default:
841         g_assert_not_reached();
842     }
843 
844     return val;
845 }
846 
847 static const MemoryRegionOps next_floppy_ops = {
848     .read = next_floppy_read,
849     .write = next_floppy_write,
850     .valid.min_access_size = 1,
851     .valid.max_access_size = 4,
852     .endianness = DEVICE_BIG_ENDIAN,
853 };
854 
855 static void next_timer_write(void *opaque, hwaddr addr, uint64_t val,
856                               unsigned size)
857 {
858     switch (addr) {
859     case 0 ... 3:
860         /* Hardware timer latch - not implemented yet */
861         break;
862 
863     default:
864         g_assert_not_reached();
865     }
866 }
867 
868 static uint64_t next_timer_read(void *opaque, hwaddr addr, unsigned size)
869 {
870     uint64_t val;
871 
872     switch (addr) {
873     case 0 ... 3:
874         /*
875          * These 4 registers are the hardware timer, not sure which register
876          * is the latch instead of data, but no problems so far.
877          *
878          * Hack: We need to have the LSB change consistently to make it work
879          */
880         val = extract32(clock(), (4 - addr - size) << 3,
881                         size << 3);
882         break;
883 
884     default:
885         g_assert_not_reached();
886     }
887 
888     return val;
889 }
890 
891 static const MemoryRegionOps next_timer_ops = {
892     .read = next_timer_read,
893     .write = next_timer_write,
894     .valid.min_access_size = 1,
895     .valid.max_access_size = 4,
896     .endianness = DEVICE_BIG_ENDIAN,
897 };
898 
899 static void next_dummy_en_write(void *opaque, hwaddr addr, uint64_t val,
900                                 unsigned size)
901 {
902     /* Do nothing */
903     return;
904 }
905 
906 static uint64_t next_dummy_en_read(void *opaque, hwaddr addr, unsigned size)
907 {
908     uint64_t val;
909 
910     switch (addr) {
911     case 0:
912         /* For now return dummy byte to allow the Ethernet test to timeout */
913         val = 0xff;
914         break;
915 
916     default:
917         val = 0;
918     }
919 
920     return val;
921 }
922 
923 static const MemoryRegionOps next_dummy_en_ops = {
924     .read = next_dummy_en_read,
925     .write = next_dummy_en_write,
926     .valid.min_access_size = 1,
927     .valid.max_access_size = 4,
928     .endianness = DEVICE_BIG_ENDIAN,
929 };
930 
931 static bool next_rtc_cmd_is_write(uint8_t cmd)
932 {
933     return (cmd >= 0x80 && cmd <= 0x9f) ||
934            (cmd == 0xb1);
935 }
936 
937 static void next_rtc_data_in_irq(void *opaque, int n, int level)
938 {
939     NeXTRTC *rtc = NEXT_RTC(opaque);
940 
941     if (rtc->phase < 8) {
942         rtc->command = (rtc->command << 1) | level;
943 
944         if (rtc->phase == 7 && !next_rtc_cmd_is_write(rtc->command)) {
945             if (rtc->command <= 0x1f) {
946                 /* RAM registers */
947                 rtc->retval = rtc->ram[rtc->command];
948             }
949             if ((rtc->command >= 0x20) && (rtc->command <= 0x2f)) {
950                 /* RTC */
951                 time_t time_h = time(NULL);
952                 struct tm *info = localtime(&time_h);
953                 rtc->retval = 0;
954 
955                 switch (rtc->command) {
956                 case 0x20:
957                     rtc->retval = SCR2_TOBCD(info->tm_sec);
958                     break;
959                 case 0x21:
960                     rtc->retval = SCR2_TOBCD(info->tm_min);
961                     break;
962                 case 0x22:
963                     rtc->retval = SCR2_TOBCD(info->tm_hour);
964                     break;
965                 case 0x24:
966                     rtc->retval = SCR2_TOBCD(info->tm_mday);
967                     break;
968                 case 0x25:
969                     rtc->retval = SCR2_TOBCD((info->tm_mon + 1));
970                     break;
971                 case 0x26:
972                     rtc->retval = SCR2_TOBCD((info->tm_year - 100));
973                     break;
974                 }
975             }
976             if (rtc->command == 0x30) {
977                 /* read the status 0x30 */
978                 rtc->retval = rtc->status;
979             }
980             if (rtc->command == 0x31) {
981                 /* read the control 0x31 */
982                 rtc->retval = rtc->control;
983             }
984         }
985     }
986     if (rtc->phase >= 8 && rtc->phase < 16) {
987         if (next_rtc_cmd_is_write(rtc->command)) {
988             /* Shift in value to write */
989             rtc->value = (rtc->value << 1) | level;
990         } else {
991             /* Shift out value to read */
992             if (rtc->retval & (0x80 >> (rtc->phase - 8))) {
993                 qemu_irq_raise(rtc->data_out_irq);
994             } else {
995                 qemu_irq_lower(rtc->data_out_irq);
996             }
997         }
998     }
999 
1000     rtc->phase++;
1001     if (rtc->phase == 16 && next_rtc_cmd_is_write(rtc->command)) {
1002         if (rtc->command >= 0x80 && rtc->command <= 0x9f) {
1003             /* RAM registers */
1004             rtc->ram[rtc->command - 0x80] = rtc->value;
1005         }
1006         if (rtc->command == 0xb1) {
1007             /* write to 0x30 register */
1008             if (rtc->value & 0x04) {
1009                 /* clear FTU */
1010                 rtc->status = rtc->status & (~0x18);
1011                 qemu_irq_lower(rtc->power_irq);
1012             }
1013         }
1014     }
1015 }
1016 
1017 static void next_rtc_cmd_reset_irq(void *opaque, int n, int level)
1018 {
1019     NeXTRTC *rtc = NEXT_RTC(opaque);
1020 
1021     if (level) {
1022         rtc->phase = 0;
1023         rtc->command = 0;
1024         rtc->value = 0;
1025     }
1026 }
1027 
1028 static void next_rtc_reset_hold(Object *obj, ResetType type)
1029 {
1030     NeXTRTC *rtc = NEXT_RTC(obj);
1031 
1032     rtc->status = 0x90;
1033 
1034     /* Load RTC RAM - TODO: provide possibility to load contents from file */
1035     memcpy(rtc->ram, rtc_ram2, 32);
1036 }
1037 
1038 static void next_rtc_init(Object *obj)
1039 {
1040     NeXTRTC *rtc = NEXT_RTC(obj);
1041 
1042     qdev_init_gpio_in_named(DEVICE(obj), next_rtc_data_in_irq,
1043                             "rtc-data-in", 1);
1044     qdev_init_gpio_out_named(DEVICE(obj), &rtc->data_out_irq,
1045                              "rtc-data-out", 1);
1046     qdev_init_gpio_in_named(DEVICE(obj), next_rtc_cmd_reset_irq,
1047                             "rtc-cmd-reset", 1);
1048     qdev_init_gpio_out_named(DEVICE(obj), &rtc->power_irq,
1049                              "rtc-power-out", 1);
1050 }
1051 
1052 static const VMStateDescription next_rtc_vmstate = {
1053     .name = "next-rtc",
1054     .version_id = 3,
1055     .minimum_version_id = 3,
1056     .fields = (const VMStateField[]) {
1057         VMSTATE_INT8(phase, NeXTRTC),
1058         VMSTATE_UINT8_ARRAY(ram, NeXTRTC, 32),
1059         VMSTATE_UINT8(command, NeXTRTC),
1060         VMSTATE_UINT8(value, NeXTRTC),
1061         VMSTATE_UINT8(status, NeXTRTC),
1062         VMSTATE_UINT8(control, NeXTRTC),
1063         VMSTATE_UINT8(retval, NeXTRTC),
1064         VMSTATE_END_OF_LIST()
1065     },
1066 };
1067 
1068 static void next_rtc_class_init(ObjectClass *klass, void *data)
1069 {
1070     DeviceClass *dc = DEVICE_CLASS(klass);
1071     ResettableClass *rc = RESETTABLE_CLASS(klass);
1072 
1073     dc->desc = "NeXT RTC";
1074     dc->vmsd = &next_rtc_vmstate;
1075     rc->phases.hold = next_rtc_reset_hold;
1076 }
1077 
1078 static const TypeInfo next_rtc_info = {
1079     .name = TYPE_NEXT_RTC,
1080     .parent = TYPE_SYS_BUS_DEVICE,
1081     .instance_init = next_rtc_init,
1082     .instance_size = sizeof(NeXTRTC),
1083     .class_init = next_rtc_class_init,
1084 };
1085 
1086 static void next_pc_rtc_data_in_irq(void *opaque, int n, int level)
1087 {
1088     NeXTPC *s = NEXT_PC(opaque);
1089     uint8_t scr2_2 = extract32(s->scr2, 8, 8);
1090 
1091     if (level) {
1092         scr2_2 |= SCR2_RTDATA;
1093     } else {
1094         scr2_2 &= ~SCR2_RTDATA;
1095     }
1096 
1097     s->scr2 = deposit32(s->scr2, 8, 8, scr2_2);
1098 }
1099 
1100 static void next_pc_reset_hold(Object *obj, ResetType type)
1101 {
1102     NeXTPC *s = NEXT_PC(obj);
1103 
1104     /* Set internal registers to initial values */
1105     /*     0x0000XX00 << vital bits */
1106     s->scr1 = 0x00011102;
1107     s->scr2 = 0x00ff0c80;
1108     s->old_scr2 = s->scr2;
1109 }
1110 
1111 static void next_pc_realize(DeviceState *dev, Error **errp)
1112 {
1113     NeXTPC *s = NEXT_PC(dev);
1114     SysBusDevice *sbd;
1115     DeviceState *d;
1116 
1117     /* SCSI */
1118     sbd = SYS_BUS_DEVICE(&s->next_scsi);
1119     if (!sysbus_realize(sbd, errp)) {
1120         return;
1121     }
1122 
1123     d = DEVICE(object_resolve_path_component(OBJECT(&s->next_scsi), "esp"));
1124     sysbus_connect_irq(SYS_BUS_DEVICE(d), 0,
1125                        qdev_get_gpio_in(DEVICE(s), NEXT_SCSI_I));
1126 
1127     s->scsi_reset = qdev_get_gpio_in(d, 0);
1128     s->scsi_dma = qdev_get_gpio_in(d, 1);
1129 
1130     /* ESCC */
1131     d = DEVICE(&s->escc);
1132     qdev_prop_set_uint32(d, "disabled", 0);
1133     qdev_prop_set_uint32(d, "frequency", 9600 * 384);
1134     qdev_prop_set_uint32(d, "it_shift", 0);
1135     qdev_prop_set_bit(d, "bit_swap", true);
1136     qdev_prop_set_chr(d, "chrB", serial_hd(1));
1137     qdev_prop_set_chr(d, "chrA", serial_hd(0));
1138     qdev_prop_set_uint32(d, "chnBtype", escc_serial);
1139     qdev_prop_set_uint32(d, "chnAtype", escc_serial);
1140 
1141     sbd = SYS_BUS_DEVICE(d);
1142     if (!sysbus_realize(sbd, errp)) {
1143         return;
1144     }
1145     sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(dev, NEXT_SCC_I));
1146     sysbus_connect_irq(sbd, 1, qdev_get_gpio_in(dev, NEXT_SCC_DMA_I));
1147 
1148     /* RTC */
1149     d = DEVICE(&s->rtc);
1150     if (!sysbus_realize(SYS_BUS_DEVICE(d), errp)) {
1151         return;
1152     }
1153     /* Data from NeXTPC to RTC */
1154     qdev_connect_gpio_out_named(dev, "rtc-data-out", 0,
1155                                 qdev_get_gpio_in_named(d, "rtc-data-in", 0));
1156     /* Data from RTC to NeXTPC */
1157     qdev_connect_gpio_out_named(d, "rtc-data-out", 0,
1158                                 qdev_get_gpio_in_named(dev,
1159                                                        "rtc-data-in", 0));
1160     qdev_connect_gpio_out_named(dev, "rtc-cmd-reset", 0,
1161                                 qdev_get_gpio_in_named(d, "rtc-cmd-reset", 0));
1162     qdev_connect_gpio_out_named(d, "rtc-power-out", 0,
1163                                 qdev_get_gpio_in(dev, NEXT_PWR_I));
1164 }
1165 
1166 static void next_pc_init(Object *obj)
1167 {
1168     NeXTPC *s = NEXT_PC(obj);
1169     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
1170 
1171     qdev_init_gpio_in(DEVICE(obj), next_irq, NEXT_NUM_IRQS);
1172 
1173     memory_region_init_io(&s->mmiomem, OBJECT(s), &next_mmio_ops, s,
1174                           "next.mmio", 0x9000);
1175     sysbus_init_mmio(sbd, &s->mmiomem);
1176 
1177     memory_region_init_io(&s->dummyen_mem, OBJECT(s), &next_dummy_en_ops, s,
1178                           "next.en", 0x20);
1179     sysbus_init_mmio(sbd, &s->dummyen_mem);
1180 
1181     object_initialize_child(obj, "next-scsi", &s->next_scsi, TYPE_NEXT_SCSI);
1182     sysbus_init_mmio(sbd,
1183                      sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->next_scsi), 0));
1184 
1185     memory_region_init_io(&s->floppy_mem, OBJECT(s), &next_floppy_ops, s,
1186                           "next.floppy", 4);
1187     sysbus_init_mmio(sbd, &s->floppy_mem);
1188 
1189     object_initialize_child(obj, "escc", &s->escc, TYPE_ESCC);
1190     sysbus_init_mmio(sbd,
1191                      sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->escc), 0));
1192 
1193     memory_region_init_io(&s->timer_mem, OBJECT(s), &next_timer_ops, s,
1194                           "next.timer", 4);
1195     sysbus_init_mmio(sbd, &s->timer_mem);
1196 
1197     object_initialize_child(obj, "rtc", &s->rtc, TYPE_NEXT_RTC);
1198 
1199     qdev_init_gpio_in_named(DEVICE(obj), next_pc_rtc_data_in_irq,
1200                             "rtc-data-in", 1);
1201     qdev_init_gpio_out_named(DEVICE(obj), &s->rtc_data_irq,
1202                              "rtc-data-out", 1);
1203     qdev_init_gpio_out_named(DEVICE(obj), &s->rtc_cmd_reset_irq,
1204                              "rtc-cmd-reset", 1);
1205 }
1206 
1207 /*
1208  * If the m68k CPU implemented its inbound irq lines as GPIO lines
1209  * rather than via the m68k_set_irq_level() function we would not need
1210  * this cpu link property and could instead provide outbound IRQ lines
1211  * that the board could wire up to the CPU.
1212  */
1213 static const Property next_pc_properties[] = {
1214     DEFINE_PROP_LINK("cpu", NeXTPC, cpu, TYPE_M68K_CPU, M68kCPU *),
1215 };
1216 
1217 static const VMStateDescription next_pc_vmstate = {
1218     .name = "next-pc",
1219     .version_id = 4,
1220     .minimum_version_id = 4,
1221     .fields = (const VMStateField[]) {
1222         VMSTATE_UINT32(scr1, NeXTPC),
1223         VMSTATE_UINT32(scr2, NeXTPC),
1224         VMSTATE_UINT32(old_scr2, NeXTPC),
1225         VMSTATE_UINT32(int_mask, NeXTPC),
1226         VMSTATE_UINT32(int_status, NeXTPC),
1227         VMSTATE_UINT32(led, NeXTPC),
1228         VMSTATE_END_OF_LIST()
1229     },
1230 };
1231 
1232 static void next_pc_class_init(ObjectClass *klass, void *data)
1233 {
1234     DeviceClass *dc = DEVICE_CLASS(klass);
1235     ResettableClass *rc = RESETTABLE_CLASS(klass);
1236 
1237     dc->desc = "NeXT Peripheral Controller";
1238     dc->realize = next_pc_realize;
1239     device_class_set_props(dc, next_pc_properties);
1240     dc->vmsd = &next_pc_vmstate;
1241     rc->phases.hold = next_pc_reset_hold;
1242 }
1243 
1244 static const TypeInfo next_pc_info = {
1245     .name = TYPE_NEXT_PC,
1246     .parent = TYPE_SYS_BUS_DEVICE,
1247     .instance_init = next_pc_init,
1248     .instance_size = sizeof(NeXTPC),
1249     .class_init = next_pc_class_init,
1250 };
1251 
1252 static void next_cube_init(MachineState *machine)
1253 {
1254     NeXTState *m = NEXT_MACHINE(machine);
1255     M68kCPU *cpu;
1256     CPUM68KState *env;
1257     MemoryRegion *sysmem = get_system_memory();
1258     const char *bios_name = machine->firmware ?: ROM_FILE;
1259     DeviceState *pcdev;
1260 
1261     /* Initialize the cpu core */
1262     cpu = M68K_CPU(cpu_create(machine->cpu_type));
1263     if (!cpu) {
1264         error_report("Unable to find m68k CPU definition");
1265         exit(1);
1266     }
1267     env = &cpu->env;
1268 
1269     /* Initialize CPU registers.  */
1270     env->vbr = 0;
1271     env->sr  = 0x2700;
1272 
1273     /* Peripheral Controller */
1274     pcdev = qdev_new(TYPE_NEXT_PC);
1275     object_property_set_link(OBJECT(pcdev), "cpu", OBJECT(cpu), &error_abort);
1276     sysbus_realize_and_unref(SYS_BUS_DEVICE(pcdev), &error_fatal);
1277 
1278     /* 64MB RAM starting at 0x04000000  */
1279     memory_region_add_subregion(sysmem, 0x04000000, machine->ram);
1280 
1281     /* Framebuffer */
1282     sysbus_create_simple(TYPE_NEXTFB, 0x0B000000, NULL);
1283 
1284     /* MMIO */
1285     sysbus_mmio_map(SYS_BUS_DEVICE(pcdev), 0, 0x02005000);
1286 
1287     /* BMAP IO - acts as a catch-all for now */
1288     sysbus_mmio_map(SYS_BUS_DEVICE(pcdev), 1, 0x02100000);
1289 
1290     /* en network (dummy) */
1291     sysbus_mmio_map(SYS_BUS_DEVICE(pcdev), 1, 0x02106000);
1292 
1293     /* unknown: Brightness control register? */
1294     empty_slot_init("next.unknown.0", 0x02110000, 0x10);
1295     /* unknown: Magneto-Optical drive controller? */
1296     empty_slot_init("next.unknown.1", 0x02112000, 0x10);
1297 
1298     /* SCSI */
1299     sysbus_mmio_map(SYS_BUS_DEVICE(pcdev), 2, 0x02114000);
1300     /* Floppy */
1301     sysbus_mmio_map(SYS_BUS_DEVICE(pcdev), 3, 0x02114108);
1302     /* ESCC */
1303     sysbus_mmio_map(SYS_BUS_DEVICE(pcdev), 4, 0x02118000);
1304 
1305     /* unknown: Serial clock configuration register? */
1306     empty_slot_init("next.unknown.2", 0x02118004, 0x10);
1307 
1308     /* Timer */
1309     sysbus_mmio_map(SYS_BUS_DEVICE(pcdev), 5, 0x0211a000);
1310 
1311     /* BMAP memory */
1312     memory_region_init_ram_flags_nomigrate(&m->bmapm1, NULL, "next.bmapmem",
1313                                            64, RAM_SHARED, &error_fatal);
1314     memory_region_add_subregion(sysmem, 0x020c0000, &m->bmapm1);
1315     /* The Rev_2.5_v66.bin firmware accesses it at 0x820c0020, too */
1316     memory_region_init_alias(&m->bmapm2, NULL, "next.bmapmem2", &m->bmapm1,
1317                              0x0, 64);
1318     memory_region_add_subregion(sysmem, 0x820c0000, &m->bmapm2);
1319 
1320     /* KBD */
1321     sysbus_create_simple(TYPE_NEXTKBD, 0x0200e000, NULL);
1322 
1323     /* Load ROM here */
1324     memory_region_init_rom(&m->rom, NULL, "next.rom", 0x20000, &error_fatal);
1325     memory_region_add_subregion(sysmem, 0x01000000, &m->rom);
1326     memory_region_init_alias(&m->rom2, NULL, "next.rom2", &m->rom, 0x0,
1327                              0x20000);
1328     memory_region_add_subregion(sysmem, 0x0, &m->rom2);
1329     if (load_image_targphys(bios_name, 0x01000000, 0x20000) < 8) {
1330         if (!qtest_enabled()) {
1331             error_report("Failed to load firmware '%s'.", bios_name);
1332         }
1333     } else {
1334         uint8_t *ptr;
1335         /* Initial PC is always at offset 4 in firmware binaries */
1336         ptr = rom_ptr(0x01000004, 4);
1337         g_assert(ptr != NULL);
1338         env->pc = ldl_be_p(ptr);
1339         if (env->pc >= 0x01020000) {
1340             error_report("'%s' does not seem to be a valid firmware image.",
1341                          bios_name);
1342             exit(1);
1343         }
1344     }
1345 
1346     /* DMA */
1347     memory_region_init_io(&m->dmamem, NULL, &next_dma_ops, machine,
1348                           "next.dma", 0x5000);
1349     memory_region_add_subregion(sysmem, 0x02000000, &m->dmamem);
1350 }
1351 
1352 static void next_machine_class_init(ObjectClass *oc, void *data)
1353 {
1354     MachineClass *mc = MACHINE_CLASS(oc);
1355 
1356     mc->desc = "NeXT Cube";
1357     mc->init = next_cube_init;
1358     mc->block_default_type = IF_SCSI;
1359     mc->default_ram_size = RAM_SIZE;
1360     mc->default_ram_id = "next.ram";
1361     mc->default_cpu_type = M68K_CPU_TYPE_NAME("m68040");
1362     mc->no_cdrom = true;
1363 }
1364 
1365 static const TypeInfo next_typeinfo = {
1366     .name = TYPE_NEXT_MACHINE,
1367     .parent = TYPE_MACHINE,
1368     .class_init = next_machine_class_init,
1369     .instance_size = sizeof(NeXTState),
1370 };
1371 
1372 static void next_register_type(void)
1373 {
1374     type_register_static(&next_typeinfo);
1375     type_register_static(&next_pc_info);
1376     type_register_static(&next_scsi_info);
1377     type_register_static(&next_rtc_info);
1378 }
1379 
1380 type_init(next_register_type)
1381